Insight

Insight Analytics and Audit (Insight) leverages OpenSearch and OpenSearch Dashboard to perform analytics on audit events and log messages aggregated in the Audit Store. Both are distributed as Docker containers that can be hosted on ESAs.

ILM Export

This section outlines the ILM export configuration for various log and metric indices. The objective is to manage the lifecycle of these indices efficiently, ensuring data is archived or deleted as required.

ILM Export Configuration Considerations

• Maximum size: Defines the maximum size an index can reach before getting exported.

• Maximum doc count: Defines the maximum doc count an index can reach before getting exported.

• Maximum index age: Defines the maximum age an index can reach before getting exported.

• Conditions: ILM Export occurs when either of the above limits is reached where index entries from the index are removed and archived to a file.

For more information about configuring ILM Export, refer ILM Multi Export.

ILM Delete

This section outlines the ILM export configuration for various log and metric indices. The objective is to manage the lifecycle of these indices efficiently, ensuring data is archived or deleted as required.

ILM Export Configuration Considerations

• Maximum size: Defines the maximum size an index can reach before getting deleted.

• Maximum doc count: Defines the maximum doc count an index can reach before getting deleted.

• Maximum age: Defines the maximum age an index can reach before getting deleted.

• Conditions: Deletion occurs when either of the above limits is reached.

For more information about configuring ILM Delete, refer ILM Multi Export.

Index Rollover

This section details the index rollover settings for various log and metric indices. Efficient rollover policies ensure high performance and manageability of the indices.

Index Deletion Configuration Considerations

• Maximum size: Defines the maximum size an index can reach before rolling over.

• Maximum doc count: Defines the maximum doc count an index can reach before rolling over.

• Maximum age: Defines the maximum age an index can reach before rolling over.

• Conditions: Index Rollover occurs when either of the limits is reached.

For more information about configuring Audit Index Rollover, refer Audit Index Rollover.

Alerting

Create a scheduled task in all the ESAs to monitor and log spikes in CPU, memory, or disk usage that exceed configured thresholds. These logs must be systematically forwarded to the Insight within the ESA.

For more information about configuring alerts, refer Working with alerts.

Requirements

1. Monitoring Metrics: The task should observe the following system metrics:

   1. CPU Usage
   2. Memory Usage
   3. Disk Usage

2. Threshold Configuration

   1. Define specific thresholds for CPU, memory, and disk usage.
   2. Ensure these thresholds can be adjusted as needed.

3. Log Generation

   Generate detailed logs whenever a spike in CPU, memory, or disk usage exceeds the configured threshold.

4. Log Forwarding

   Implement mechanisms to forward these logs to the Insight within the ESA.

Implementation Steps

1. Script Development

   • Develop a script to monitor CPU, memory, and disk usage.
   • Incorporate threshold parameters into the script.

2. Schedule the task using Task Scheduler.

   For more information about creating scheduled task using task scheduler, refer Creating a scheduled task.

3. Logging Mechanism

   Use logger library to write logs to syslog.

4. Test and Validate

   • Conduct thorough testing to ensure the script accurately detects and logs spikes.

   • Validate that logs are correctly forwarded to and received by the Insight.

By implementing this scheduled task, the ability to monitor system health and respond proactively to potential issues is enhanced, thereby improving overall system stability and security compliance.

Audit Store Dashboards

It is recommended that default dashboards in ESAs are not modified or deleted.

For more information on Protegrity provided dashboards, refer Working with Protegrity dashboards.